Trust wallet crap lost $7 million!

[Rashlyowl]

People using the wallet in particular are mainly believing in binance. Binance promoted the wallet and even as it's main wallet. Users aren't all smart to understand the differences between wallets, this is why they feel confortable with the most trusted source they think it is. In this case it's binance the giant exchanger in the market. Fortunetly it will cover the loss, but this rises a big red flag about all closed source applications.

Binance must be held accountable for all the problems they cause their clients & this form of responsibility deserves appreciation. After this, people should realize how red flag Binance is & all their centralization products.

I asked Google with keywords: Is trust wallet open source?

Yes, Trust Wallet uses a mix: its core library, Wallet Core, is open-source (C++), but the main mobile apps and browser extension have proprietary elements and, as seen in late 2025, have faced vulnerabilities, leading to strategic code closures for security reasons, making it not fully open-source in the traditional sense, though it leverages open-source tools.

You can see the answer I got from the AI ​​summary, summary makes a convoluted meaning, at the beginning it says that the application is open-source, but at the end of the sentence it says not fully open-source. Dangerous summary for beginners who want to find out factual information about trust wallet.

[Kavelj22]

I asked Google with keywords: Is trust wallet open source?

Yes, Trust Wallet uses a mix: its core library, Wallet Core, is open-source (C++), but the main mobile apps and browser extension have proprietary elements and, as seen in late 2025, have faced vulnerabilities, leading to strategic code closures for security reasons, making it not fully open-source in the traditional sense, though it leverages open-source tools.

You can see the answer I got from the AI ​​summary, summary makes a convoluted meaning, at the beginning it says that the application is open-source, but at the end of the sentence it says not fully open-source. Dangerous summary for beginners who want to find out factual information about trust wallet.

Afaik, TrustWallet was initially a decentralized wallet created by two developers who are members of this forum. Later, Binance bought the project and converted it into a fully centralized, closed-source wallet. There were no complaints about these wallet (untrustwallet), while the potential for risk remains, given that the wallet is closed-source and its algorithms cannot be verified.

Edit: The founder of trustwallet is an Ukrainian dev named Viktor Radchenko who linched the project in 2017, then Binance bought it in 2018.

[jcojci]

Wait until they ask for KYC, your biometric selfie, and your proof of address

Those who lose much money from Trust Wallet willing to do that. At least, they think that their funds can return to them although they must do KYC with all things needed.

I read that news. Sorry for those who drained their money. Trust Wallet needs to resolve it immediately and return the money.
Trust Wallet gives an update in 20 hours ago for the compensation process:
...
Source: https://x.com/TrustWallet/status/2004623205005492651

Good thing they decide to compensate the losses, but i think it will take time as there's no centralized record of the accounts, anyone can claim that they also one of the victims lost from the recent hacked, transaction ids and address are publicly available which is one of the requirements asked on the form on the site, email is not required on trustwallet too so... Idk how they will manage to refund all the victims.

It is clearly that will take time. I am not sure if they will finish all of the mess shortly. We don't know how many people lost their funds so Trust Wallet team must clarify this first and compensate it gradually. It's important lesson for everyone to learn.

[Rashlyowl]

Afaik, TrustWallet was initially a decentralized wallet created by two developers who are members of this forum. Later, Binance bought the project and converted it into a fully centralized, closed-source wallet. There were no complaints about these wallet (untrustwallet), while the potential for risk remains, given that the wallet is closed-source and its algorithms cannot be verified.

Edit: The founder of trustwallet is an Ukrainian dev named Viktor Radchenko who linched the project in 2017, then Binance bought it in 2018.

Whatever it is, when open-source becomes closed-source, bad things are bound to happen. I've heard from other users that this isn't the first time  happened to this wallet, but it's the second. I think they should reconsider changing brand name, Trust Wallet isn't working for them.



By the way, I searched information about the developer you mentioned from this forum, but I couldn't find it at all, are you giving false information bros @Kavelj22?

[coupable]

People using the wallet in particular are mainly believing in binance. Binance promoted the wallet and even as it's main wallet. Users aren't all smart to understand the differences between wallets, this is why they feel confortable with the most trusted source they think it is. In this case it's binance the giant exchanger in the market. Fortunetly it will cover the loss, but this rises a big red flag about all closed source applications.

Binance must be held accountable for all the problems they cause their clients & this form of responsibility deserves appreciation. After this, people should realize how red flag Binance is & all their centralization products.

When I see the number of users and tie it with the hacked amount, I can tell sadly that people won't get rid off those closed source applications because this exactly the type of applications they are looking for. People are still not able to bear responsability holding their savings in their own private wallets. They see binance as their bank who garanted loss recovery each time something happens. They don't know that they are under the mercy of binance and that they have nothing to do if binance decides not to cover the loss for whatever reason.

[dkbit98]

Such kind of attack can happen to any extension, regardless of whether it is open source or closed source. In fact, open source projects can sometimes be even more vulnerable to code injection.

Show me one example with open source wallet having this kind of stupid mistake that resulted in $7 lost crypto 
I never heard anything similar happening to Electrum or Trezor, and they knew better when they stopped all work on browser extensions.
Trust is 100% to blame for this loss.

Wait until they ask for KYC, your biometric selfie, and your proof of address

They literally asked for everyone to complete KYC verification to get a refund... this is how idiotic whole ''trust'' project is 

[albon]

Trust is 100% to blame for this loss.

I agree with you. Popular open source wallets may have a low chance of this happening because their codes constantly reviewed by security experts and regular updates are released to fix any vulnerabilities that may be exploited by hackers and attackers. 

The fact that many of these wallets do not rely on browser extensions also reduces the risk of incidents like what happened with Trust Wallet, also interacting with websites can expose users to phishing sites that may drain their wallets. However, i think that similar issues could happen with open source wallets if the security audits and updates are ignored, even though their code is publicly available on GitHub.

For me, Trust Wallet was one of the wallets I used to use previously, but after Binance acquired it, I stopped using it except for small transactions. Now, open-source alternatives are more practical than this wallet, and many should learn from this incident to exercise caution and perhaps stop relying on this wallet in the future.

[satscraper]

Such kind of attack can happen to any extension, regardless of whether it is open source or closed source. In fact, open source projects can sometimes be even more vulnerable to code injection.

Show me one example with open source wallet having this kind of stupid mistake that resulted in $7 lost crypto  
I never heard anything similar happening to Electrum or Trezor, and they knew better when they stopped all work on browser extensions.
Trust is 100% to blame for this loss.

It may happen even to Electrum and Trezor.

Give hackers access to project’s development accounts and they will inject malicious code into the open‑source project with no extra effort.

Once again, the code injection into Trust Wallet happened not because it is open source, but because the relevant development account was compromised.

[dkbit98]

It may happen even to Electrum and Trezor.

And pigs may fly 
I told you to give me one single example with open source wallets and you couldn't do that.
On the contrary, I can give you numerous examples when people lost money because they used closed source wallet crap like trust, tangem and others.
If some amateur can not handle and secure development account than whole team is full of clowns.

[Zwei]

It may happen even to Electrum and Trezor.

it may happen, yes. but did it happen? no.

Once again, the code injection into Trust Wallet happened not because it is open source

i think you meant to say closed source there.

but because the relevant development account was compromised.

regardless, i would rather use an open source wallet, at least i know their code is public, gets reviewed, tested and whatnot (which have a higher chance of any malicious code being found/stopped before it can do any real damage).
that feels much safer to me than clicking update/install and blindly trusting a company (which i'm just a number to) to do their job in exchange for collecting my data and fees from third parties they work with.

If some amateur can not handle and secure development account than whole team is full of clowns.

ledger *cough*, sorry, i had something stuck in my throat, hehehe.

[nutildah]

It may happen even to Electrum and Trezor.

And pigs may fly  
I told you to give me one single example with open source wallets and you couldn't do that.

Here you go:

https://www.reddit.com/r/CryptoCurrency/comments/a9yji3/electrum_wallet_hacked_200_btc_stolen_so_far/

On the contrary, I can give you numerous examples when people lost money because they used closed source wallet crap like trust, tangem and others.

The core wallet features of Trust Wallet are open source:

https://github.com/trustwallet/wallet-core

But it appears this recent exploit was dependent on closed source software.

[dkbit98]

https://www.reddit.com/r/CryptoCurrency/comments/a9yji3/electrum_wallet_hacked_200_btc_stolen_so_far/

I know about this, and it's not the same case.
You had to download and install fake electrum wallet from different scam link.

The core wallet features of Trust Wallet are open source

Go ahead and use this ''core'' if you think it's open source.
Mobile application is closed source and it's impossible to verify source code.
That can clearly be confirmed on Wallet Scrutiny page.
https://walletscrutiny.com/android/com.wallet.crypto.trustapp/

[nutildah]

You had to download and install fake electrum wallet from different scam link.

You're missing the point: hackers modified Electrum to display bogus messages. You're claiming Electrum has never been hacked, which is false. You can argue its not a "hack" but it was a clear exploitation of a weakness in the software design.

https://www.zdnet.com/article/users-report-losing-bitcoin-in-clever-hack-of-electrum-wallets/
https://thenextweb.com/news/behind-the-scenes-electrum-hackers-steal-4m-with-bitcoin-phishing-attacks
https://cryptopotato.com/electrum-wallet-hacked-over-900k-got-stolen-in-a-phishing-attack/

Go ahead and use this ''core'' if you think it's open source.

Its not what I think. All the cryptographic functions of the wallet are open source (signing, private key & seed phrase storage, etc.). What's closed source is stuff pertaining to app UI, integrations & extensions.

I have been using Trust Wallet for years with zero problems. Granted I never messed around extra features, just for receiving, holding, and sending. And I'm not justifying their incompetence, I'm just saying the situation isn't as black & white as you're trying to make it out to be.

[The Cryptovator]

I have been using Trust Wallet for years with zero problems. Granted I never messed around extra features, just for receiving, holding, and sending. And I'm not justifying their incompetence, I'm just saying the situation isn't as black & white as you're trying to make it out to be.

Same here, I have been using Trust Wallet for my local transactions. 'Local' means receiving payment from clients or sending payment to plugs, etc. Because I am not using exchange for receiving funds since they sometimes block, and I am not using hardware wallet addresses because I don't want to let them know my wealth or balance. So the Trust Wallet was my first choice since it does support multiple coins. The easy interface also encouraged me to use it; however, I don't use Chrome extensions.

I don't know; I was often discouraged from using any kind of Chrome extension. Even I don't feel comfortable with the MetaMask wallet extension. So I have never used the Trust Wallet extension, and I am not sure if this thread belongs to the Scam Accusation board since Trust Wallet isn't scamming here. I am not fan of using closed-source wallets, but in this case hackers are responsible. Rather, it seems Trust Wallet has been trying for compensation for affected users. This would be one of the examples in the future, even a non-custodial wallets offer compensation upon hacking.

[dkbit98]

You're missing the point: hackers modified Electrum to display bogus messages. You're claiming Electrum has never been hacked, which is false. You can argue its not a "hack" but it was a clear exploitation of a weakness in the software design.

No, they modified electrum servers, not electrum software, so your claims are misleading.

Its not what I think. All the cryptographic functions of the wallet are open source (signing, private key & seed phrase storage, etc.). What's closed source is stuff pertaining to app UI, integrations & extensions.

Prove it.
Just build the wallet from scratch using source code from github.
You actually don't know anything about trust wallet and what part is open source and what closed source.

I have been using Trust Wallet for years with zero problems.  I'm just saying the situation isn't as black & white as you're trying to make it out to be.

And I know drug addicts who used drugs for years with zero problems.
I honestly don't care what you use and what you promote.

[virasog]

This is exactly why I keep telling people all the time to stay away from closed source crap like Trust wallet!

Their stupid browser extension had security breach that resulted in $6 million worth of losses in crypto!

I have stopped using Trust Wallet a long time ago and using an open source wallet Unstoppable, and I am quite satisfied with it.

However, I have a question. Trust Wallet claims that they have a security breach, which resulted in this crypto loss. Are you saying that since the wallet is closed source and they have modified the code and hacked people's money?

What I really wanted to ask is that can't there be any genuine security breaches in open-source wallet ?

[nutildah]

You're missing the point: hackers modified Electrum to display bogus messages. You're claiming Electrum has never been hacked, which is false. You can argue its not a "hack" but it was a clear exploitation of a weakness in the software design.

No, they modified electrum servers, not electrum software, so your claims are misleading.

You're now arguing for the sake of arguing. The Electrum servers are more part of the wallet than a Chrome Web Store API key is part of Trust Wallet. Both hacks involved theft of seed phrases through social engineering -- it is basically the same kind of attack, just through different mechanisms.

One of the differences is Trust Wallet users were reimbursed for their losses and Electrum users were not.

Prove it.
Just build the wallet from scratch using source code from github.
You actually don't know anything about trust wallet and what part is open source and what closed source.

I don't have to do that when people with more intimate knowledge of the subject than you or I have performed audits on the open source portion of the Trust Wallet code and verified it does exactly what it claims to do. Its not on me to educate you on the subject when the internet is freely available and at your disposal.

I honestly don't care what you use and what you promote.

Why do you have to mischaracterize my words in every conversation? I am not "promoting" Trust Wallet in any way. What you are doing is dishonest and its because you simply can't admit when you're wrong, its just sad.

What I really wanted to ask is that can't there be any genuine security breaches in open-source wallet ?

You clearly didn't read a single reply in this thread.